CVE-2023-23382: Azure Machine Learning Compute Instance Information Disclosure Vulnerability

Overview

Severity
Medium (CVSS 6.5)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Category
Information Disclosure
Exploit Status
Not Exploited
Exploitation Likelihood
Less Likely
Patch Tuesday
2023-Feb
Released
2023-02-14
Last Updated
2023-08-22
EPSS Score
1.65% (percentile: 82.0%)

FAQ

How do I check my Azure Machine Learning Compute Instance runtime version? To determine your runtime version, make a GET compute rest API call for your compute instance, then check the response. You can find the runtime version from field *versions.runtime. * Please view additional details here: https://learn.microsoft.com/en-us/rest/api/azureml/2023-04-01/compute/get How do I update my Azure Machine Learning Compute Instance runtime version? Please reference the guidance provided here: https://learn.microsoft.com/en-us/rest/api/azureml/2023-04-01/compute/update What type of information could be disclosed by this vulnerability? An attacker that successfully exploited this vulnerability could recover any data that is put in the system logs on the Compute Instance including cleartext passwords. According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability? An attacker must be authenticated and have read privileges to the logs which may contain sensitive information such as cleartext passwords. It does not require admin or other elevated privileges.

Affected Products (1)

Azure

  • Azure Machine Learning

Security Updates (1)

Acknowledgments

Nitesh Surana (@_niteshsurana) of Project Nebula <a href="https://www.zerodayinitiative.com/">Trend Micro Zero Day Initiative</a>

Revision History

  • 2023-02-14: Information published.
  • 2023-04-14: Added FAQ information. This is an informational change only.
  • 2023-08-22: Corrected one or more links in the FAQ. This is an informational change only.